Google Chrome EUVD-2026-61235

Victim must actively visit or be redirected to a crafted HTML page using an unpatched Chrome browser - this is the sole required condition (UI:R). No authentication, no special server-side configuration, no non-default browser setting, and no privileged access is required on the attacker side. Exploitation is limited by: (1) user interaction - the victim must navigate to the malicious page, ruling out fully automated zero-click attacks; (2) sandbox confinement - successful exploitation achieves code execution within Chrome's renderer sandbox only, not directly on the OS; (3) no confirmed automatable mass-exploitation path per SSVC. The vulnerability affects default Chrome installations on any supported desktop platform without requiring any specific browser feature to be enabled.

The CVSS 8.8 base score reflects network-reachable exploitation with no authentication requirement, low complexity, and full confidentiality, integrity, and availability impact - offset only by the requirement for user interaction (UI:R) and sandbox containment (S:U, no scope change). EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. SSVC signals a partially mixed picture: technical impact is rated 'total', confirming the severity of successful exploitation, but exploitation status is currently 'none' and automatable is 'no' - meaning no mass-exploitation mechanism has been identified. No CISA KEV listing and no public proof-of-concept are confirmed. The net assessment is that this is a genuine high-priority vulnerability for Chrome fleet owners - particularly given the ubiquitous deployment of Chrome and the minimal barrier to exposure (any web browsing) - but the absence of observed exploitation or published exploit code means urgency is driven by patch cadence rather than active incident response. The sandbox constraint meaningfully limits blast radius versus a full OS compromise chain.

An attacker hosts a malicious HTML page containing crafted JavaScript designed to trigger a type confusion condition in V8's object handling. When a victim browses to the page - via a phishing link, malvertising, or a compromised legitimate site - Chrome's V8 engine processes the script and the type confusion causes controlled memory corruption, leading to arbitrary code execution within the Chrome renderer sandbox. No public proof-of-concept exploit has been identified at time of analysis, but the SSVC 'total' technical impact rating confirms the theoretical exploit outcome is full renderer compromise.